Analytics Content Version: 2025.11.12 - Content Update Release Notes - Cortex

Release date: 26 November, 2025

Change type	Changes
Added a new Low Analytics BIOC	ClickFix - PowerShell executed through the run application
Added a new Low Analytics Alert	Suspicious activity indicating a potential abuse of a cloud-native email service
Added 22 new Informational Analytics BIOCs	A Microsoft Teams application was installed A Microsoft Teams bot was added to a team A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process AWS Backup recovery point deletion AWS EBS snapshot deletion AWS S3 object deletion AWS SSM parameters discovery AWS SSM parameters retrieval AWS Secrets Manager Access AWS Secrets Manager discovery Bucket's object ownership controls were modified External user added a link to a Microsoft Teams chat Foreign account was granted permissions to S3 bucket via resource-based policy GCP administrative role granted to a cloud identity Microsoft Teams application setup policy was modified Microsoft Teams external communication policy was modified Microsoft Teams messages were exported from conversation New Teams application published to the organization catalog Uncommon Launch Daemon persistency was registered or modified Uncommon attempt at discovering a sensitive file Uncommon recurring rare external host access User installed an application in Microsoft Teams via Graph API
Added 4 new Informational Analytics Alerts	External user created a Microsoft Teams conversation with suspicious operations External user started a Microsoft Teams conversation User exported multiple messages in Microsoft Teams via Graph API User sent messages in Microsoft Teams to multiple conversations via Graph API
Improved logic of a High Analytics BIOC	Suspicious SaaS API call from a Tor exit node
Improved logic of a Medium Analytics BIOC	Kubernetes vulnerability scanning tool usage
Improved logic of 14 Low Analytics BIOCs	Abnormal communication with a rare combination of TLS and HTTP User Agent Email attachment with Right-to-Left Override Unicode character Email was received from an unknown sender using a disposable domain Kubernetes pod creation from unknown container image registry Rare RDP session to a remote host Rare process executed by an AppleScript Recurring access to rare IP Recurring access to rare domain Recurring rare domain access from an unsigned process Uncommon SSH session was established Uncommon file access over WebDAV Unusual process accessed a crypto wallet's files Unusual process accessed a messaging app's files Unusual process accessed a web browser history file
Improved logic of 19 Low Analytics Alerts	A compromised process accessed a rare external host A user uploaded malware to SharePoint or OneDrive Abnormal RPC traffic to multiple hosts Abnormal SMB activity to multiple hosts Abnormal sensitive RPC traffic to multiple hosts Failed Connections Failed DNS HTTP with suspicious characteristics Impossible traveler - SSO Impossible traveler - VPN Large Upload (Generic) Logs were not collected from a data source for an abnormally long time Microsoft 365 storage services exfiltration activity Multiple Azure AD admin role removals Risk indicators detected in email Spam Bot Traffic Suspicious ICMP traffic that resembles smurf attack Suspicious identity downloaded multiple objects from a bucket User added to the SMS Admins local group
Improved logic of 118 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes DaemonSet was created A Kubernetes Pod was created with a sidecar container A Kubernetes Pod was deleted A Kubernetes ReplicaSet was created A Kubernetes StatefulSet was created A Kubernetes cluster role binding was created or deleted A Kubernetes deployment was created A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes node service account activity from external IP A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account executed an unusual API call A Kubernetes service account has enumerated its permissions A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A possible risky login to Azure AWS Storage Gateway enumeration AWS Storage Gateway file share enumeration AWS user creation Abnormal Communication to a Rare Domain Abnormal Recurring Communications to a Rare Domain An Azure application reached a throttling API rate An identity accessed a cloud storage for the first time An identity accessed cloud storage containing sensitive data An identity attached an administrative policy to an IAM user or role AppleScript executed a shell script AppleScript interpreter dynamic library loaded into a process Attempted Azure application access from unknown tenant Authentication method was added to Azure account Azure Service principal/Application creation Azure conditional access policy creation or modification Azure group creation/deletion Azure mailbox rule creation Azure user creation/deletion Azure user password reset Credentials were added to Azure application DLP sensitive data exposed to external users Denied API call by a Kubernetes service account Email attachment with a potentially malicious file extension Email attachment with multiple extensions Email attachment(s) with potentially malicious MIME type Email containing a link with an IP address convention was detected Email containing a redirected link Email contains URL delivering high-risk file type Email has a short body or subject and was sent from an external source Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values Email mimics replies or forwards without an actual ongoing conversation Email was received from an unknown address using a public provider domain Email was received from an unknown sender using a recognized domain Email with URL shortener detected Email with file-sharing link containing auto-download parameter External email display name impersonation of internal personnel External email with a single internal recipient hidden in BCC External user invitation to Azure tenant First SSO Resource Access in the Organization First-seen email from mailbox owner to external recipient's address in the last 30 days GCP Service Account creation IAM instance profile associations were described IAM instance profile was associated with EC2 instance IAM instance profile was created IAM instance profile was replaced for EC2 instance IAM instance profiles were listed IAM policy was attached to role IAM role-attached managed policies were listed Kubernetes Pod Created With Sensitive Volume Kubernetes Pod Created with host Inter Process Communications (IPC) namespace Kubernetes Pod created with host process ID (PID) namespace Kubernetes Privileged Pod Creation Kubernetes admission controller activity Kubernetes cluster events deletion Kubernetes network policy modification Kubernetes pod creation with host network Kubernetes secret enumeration activity Kubernetes service account activity outside the cluster Moniker link detected in URL(s) OneDrive file download OneDrive file upload OneDrive folder creation Outbound email contains file-sharing service link sent to external recipient Outbound email includes an external BCC recipient observed for the first time Owner was added to Azure application Penetration testing tool attempt Possible IPFS traffic was detected Potential spoofing of internal domain spotted Privileged role used by Azure application Punycode characters detected in URL(s) Rare AppID usage to a rare destination Rare DLP rule match by user Rarely seen URL(s) within a well-known domain detected in your organization's email SaaS suspicious external domain user activity Suspicious DKIM Result Suspicious DMARC result Suspicious SPF Result Suspicious Unicode character detected in email Uncommon Launch Agent persistency was registered or modified Uncommon URL domain(s) in your organization detected in email Uncommon attempt at grabbing credentials from a sensitive file Unpopular URL(s) detected in email Unpopular domains detected in email URLs for a recipient Unrecognized internal address (AAD mismatch) Unsigned DLL Hijack into a Microsoft process Unusual Kubernetes secret access Unusual access to Microsoft 365 storage services Unusual cloud identity impersonation Unusual exec into a Kubernetes Pod Unusual hostname for the sending mail server in the email headers Unusual process accessed a macOS notes DB file Unusual process accessed web browser cookies Unusual process accessed web browser credentials Unusual resource access by Azure application Usage of homograph characters detected in an email Usage of homograph characters detected in an email attachment(s) name Usage of homograph characters detected in an email's from header User accessed SaaS resource via anonymous link X-Forefront-Antispam-Report has flagged this email as a potential threat
Improved logic of 40 Informational Analytics Alerts	A compromised process accessed a rare cloud resource Abnormal Allocation of compute resources in multiple regions Abnormal RDP connections to multiple hosts Abnormal SMB scanning activity to multiple hosts Abnormal connections to a dormant host from a newly seen endpoint Allocation of multiple cloud compute resources An Azure identity performed multiple actions that were denied Azure enumeration activity using Microsoft Graph API Azure uncommon increase in API request sizes Cloud user performed multiple actions that were denied Deletion of multiple cloud resources Kubernetes enumeration activity Log enumeration via cloud native logging service Mailbox enumeration activity by Azure application Massive file downloads from SaaS service Microsoft OneDrive enumeration activity Microsoft OneNote enumeration activity Microsoft SharePoint enumeration activity Microsoft Teams enumeration activity Multiple Okta MFA requests sent to a user Multiple cloud snapshots export Multiple failed logins from a single IP Numerous emails sent by a single sender to multiple internal recipients Okta Reported Threat Detected Okta account reset password attempt Okta account unlock Okta device assignment Port Scan Possible Privilege Escalation using Delegated MSA account Potential NTLM Relay Attack Rare access to known advertising domains SSO Password Spray Short-lived Azure AD user account Single account excessively locked out Storage enumeration activity Uncommon WPAD queries Unusual SSH Activity Unusual attachment volume in outbound emails Upload pattern that resembles Peer to Peer traffic User and Group Enumeration via SAMR
Increased the severity to Low for 2 Analytics BIOCs	Modification of NTLM restrictions in the Registry Sending unusual file(s) to an external address
Decreased the severity to Informational for an Analytics BIOC	Remote usage of an Azure Service Principal token
Decreased the severity to Informational for an Analytics Alert	Suspicious secrets dump activity
Changed metadata of 2 Medium Analytics BIOCs	Logging was impaired via external encryption key Phantom DLL Loading
Changed metadata of 4 Low Analytics BIOCs	Contained process execution with a rare GitHub URL Possible DLL Search Order Hijacking Suspicious access of the System Management Container Uncommon remote monitoring and management tool
Changed metadata of a Low Analytics Alert	User collected remote shared files in an archive
Changed metadata of 10 Informational Analytics BIOCs	An EBS snapshot block was downloaded Cloud access key creation Executable moved to Windows system folder Globally uncommon high entropy process was executed Globally uncommon image load from a signed process Possible DLL Hijack into a Microsoft process Possible DLL Side-Loading Rare signature signed executable executed in the network Uncommon access to cloud platforms' sensitive files by a scripting engine Unusual use of a 'SysInternals' tool
Changed metadata of 4 Informational Analytics Alerts	A user performed suspiciously massive file activity A user printed an unusual number of files Possible data exfiltration over a USB storage device Possible internal data exfiltration over a USB storage device